Trying to Save to 2 Specific Folders Causes Connection to Internet

[Cypherdude]

Whenever I try to Save to one of 2 specific local folders, in many applications, I get a connection to the Internet. It doesn't matter what the application is. It could be Notepad.exe, wordpad.exe, or Excel 2010-32 bit. FireFox v63-64 bit also does this. Corel's WordPerfect X5-32 bit does not do this. The 2 folders are not system related and are not even on the C: drive. This behavior only occurs with these 2 local folders. They are:
d:\t
d:\download\~Internet\Mozilla

The application, such as Notepad.exe, will send an ftp type Syn-Sent to the IP below. The IP it sends to depends on which folder I am trying to save in:
d:\t - 76.17.197.241 Succeed USA - New Jersey MINNESOTA-10 Comcast Cable Communications, Inc.
d:\download\~Internet\Mozilla - 54.239.172.41 Succeed USA - Washington AMAZON-4Z Amazon.com, Inc
d:\download\~Internet\Mozilla - 52.84.75.15 Succeed USA - Washington AT-88-Z Amazon Technologies Inc

In Notepad.exe's Save window, the folder's contents will not show for 40 seconds. Then the folder's contents will appear and Notepad.exe's Syn-Sent connection will disappear. No bytes are sent. I am using both Nirsoft CPorts and Sysinternals TCPView to monitor this. CPorts tells me it's an FTP connection. Both tell me it's remote port 21. It appears as though Notepad.exe is trying to connect to the remote computer, waits 40 seconds, is rejected and then displays the local folder's contents. I do not use file sharing or network sharing. I noticed this behavior after getting a BSOD today although I can't be sure that's when it started. I believe FireFox v63.0.3 64-bit caused the BSOD.

I tried various solutions such as seeing if file sharing is on for these 2 folders and if Windows 7 Pro is sharing folders. I don't believe it is. Can someone please tell me how to stop this behavior? Thanks.

 

[RoWin7]

It sounds like malware to me. Did you run an A-V scan and a Malwarebytes scan?
Notepad shouldn't have the ability to connect to the web. The program is just one file.
Does Internet\Mozilla usually contain just the installation file for Firefox?

 

[Cypherdude]

Yes, d:\download\~Internet\Mozilla has just the installer file and other miscellaneous files related to FireFox. The strange thing is Notepad.exe, wordpad.exe, Excel 2010-32 bit and FireFox v63-64 bit all exhibit this behavior. They only do this with these 2 folders. Corel's WordPerfect X5-32 bit does not do this.


I have Norton Internet Security. I will have to run a full scan tomorrow. I have not run a Malwarebytes scan yet. What is the Internet address for Malwarebytes?

 

[Megahertz07]

That is normal if you use Chrome. It spy's and track everything you do.

Internet address for Malwarebytes = 104.125.105.33

I like the SuperAntispyware as it's free and it isn't memory resident. One of the best.
Download SUPERAntiSpyware Professional Edition - Free Trial

 

[RoWin7]

You can set Chrome NOT to spy on you in the settings. Red arrow>settings>advanced>privacy and security.
Or just stay with Firefox. But now Mozilla his spying on us to, with the folders in your profile called Data Reporting and Saved Telemetry Pings. I emptied the folders and set them to Read Only.

Chrome wouldn't be using Notepad and a folder with installers to spy on you. You have malware connected to Amazon

Run a scan , if you haven't already. And SuperAntiSpyware is way past its prime of several years ago . Use Malwarebytes AntiMalware, if you haven't already. I use the free one, but you have to run it on demand. The premium runs resident.
Malwarebytes Download - Free Virus Scan & Virus Protection Tool | Malwarebytes